Privacy policy

This policy covers visits to the public site and the data you send through the form on the Support page, in line with the GDPR.

Controller

IT Bulgaria Foundation, UIC 176971032, Bl. 59–63, Dragan Tsankov Blvd., entr. Zh, fl. 2, apt. 3, Dianabad, 1172 Sofia, Bulgaria. Contact: alex@gsd.bg.

What data we collect

Name, email, how you would like to help, and what you do.

Purpose

To reply to you and to organise volunteer help.

Legal basis

Your consent (Art. 6(1)(a) GDPR).

For visit statistics — your consent, given through the cookie banner (Art. 6(1)(a) GDPR). For necessary cookies — the foundation’s legitimate interest in keeping the site working and secure (Art. 6(1)(f) GDPR).

Retention

Up to 2 years from our last contact, or until you withdraw your consent.

Sharing

We do not sell your data and do not share it with third parties for marketing.

Hosting and form processors

Lovable provides the website hosting and Lovable Cloud stores the volunteer form submissions on behalf of the foundation. Cloudflare provides network delivery and protection against automated abuse. These providers process data to deliver their services, not as recipients of the foundation’s marketing.

Cookies and analytics

The site uses the following cookies and scripts: Necessary cookies do not require analytics consent.

__cf_bm

Cloudflare bot protection; strictly necessary; expires after 30 minutes.

__dpl

Hosting deployment identifier used to route requests to the deployed site version; technical; the observed expiry was 24 hours, refreshed on page requests.

session-id

Optional visit-statistics identifier, written by the Tinybird analytics script (~flock.js), not a login cookie. Its Max-Age is 1,800 seconds (30 minutes), renewed when an analytics event is sent. Allowed only after acceptance.

gsd-analytics-consent

Remembers acceptance or rejection of analytics for 180 days; necessary to respect your choice. It contains only your choice, not a visitor identifier.

With your acceptance, the hosting platform’s Tinybird script sends page visits, a random session identifier, timestamp, page path and full URL, referring page, browser user agent, browser language and a country inferred from the browser’s time zone to /~api/analytics. The platform also injects a Lovable events script for page views, engagement time and technical errors, sent to /__l5e/trackevents. Session replay and automatic click capture are disabled.

Neither analytics script is allowed to execute on public pages before acceptance or after rejection. You can change or withdraw your choice through “Cookie settings” in the footer. The next page load applies your choice; withdrawal removes session-id. The foundation uses only aggregated traffic reports and does not link analytics to specific individuals. Analytics data is stored by the hosting provider under its terms; you can request information or deletion at alex@gsd.bg.

Your rights

You have the right to access, correct and delete your data, to withdraw your consent at any time by writing to alex@gsd.bg, and to lodge a complaint with the Commission for Personal Data Protection (www.cpdp.bg).